CVE-2026-7425 Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP

Medium 6.0 Published 29 Apr 2026 Updated 29 Apr 2026

An adjacent attacker can crash IoT devices by sending malformed IPv6 Router Advertisement packets due to insufficient length validation in the FreeRTOS-Plus-TCP parser.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-7425?

CVE-2026-7425 is a medium-severity denial of service vulnerability in AWS FreeRTOS-Plus-TCP, published on 29 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smaller than the expected structure size.

To mitigate this issue, users should upgrade to the fixed version when available.

Weakness: CWE-125

Which versions are affected by CVE-2026-7425?

It affects 1 product.

Products include Amazon Freertos-Plus-Tcp.

How do I fix CVE-2026-7425?

No fix has been published for CVE-2026-7425 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-7425 being exploited?

There is no known exploitation of CVE-2026-7425 in the wild and no public exploit code.

Sources

Also known as GHSA-gffr-xgjg-jh9j.